A Blockchain Quest - Hacker House
- 2. INTRODUCTIONS • Hacker Fantastic, Co-Founder Hacker House • Security training and professional services • Why listen? • Talk contains a live demo, participation optional.
- 3. ⒶANARCHY VS WOLF $STREET
- 4. THIS ISN’T JUST ABOUT MONEY… • Blockchains are a new computer paradigm • De-centralized Trust • Peer-2-Peer • Privacy orientated • Secured with Cryptography • Censorship Resistant • Open World Order vs New World Order • Machine-Aided Consensus • Increased Connectivity • Decreased Overheads • Problem Solving Potential REVOLUTION
- 5. CRYPTO CYBER CRIME WAVE
- 6. RAMPANT FRAUD, US-SEC & MONEY LAUNDERING • ICO’s are dangerously misleading, often solving no real problem • Regulation tries to curb & control, questions legitimacy • Media hysteria, lack of understanding, misinformed old television & young facebook generations. #FAKEnews, Cambridge Analytica, feeds of ”Get Rich, Bitcoin” scams. Social capital. • Fools & their money are easily parted
- 7. YOU ENTER THE TAVERN… • Quest through lifecycles of “Mining” • Proof-of-Work Puzzle Consensus Acceleration • Digital Design, Modelling & Simulations • Outputs
- 8. EQUIP YOUR PARTY WISELY! • Electrical engineering primer is recommended, health & safety 101, electricity is serious business +1 • Know Ohms law, Watts, Amps, kWh, IC’s, Maker etc. • 1-10-100 mA rule, please avoid death! • Avoid fires by using proper rated wiring, for ALL PARTS OF INSTALLATION! Keep to 10A max per socket, don’t overload the ring!
- 10. GPU … ... FPGA
- 11. DEVELOPMENT BOARD • Terasic DE0-Nano Cyclone FPGA • < $100 22K LE FPGA board • Quartus II Version 13.0.1 Web Edition (Linux) • JTAG SignalTap II • Verilog design & JSON scripts for getWork (no stratum) • Hashrate 3-28MH/s (25 – 450MHz) https://github.com/cryptodashie/Open-Source-FPGA- Bitcoin-Miner
- 12. FPGA – DIGITAL DESIGN & MODELLING
- 13. FPGA PIPELINING & PERFORMANCE ENHANCING IO • Phase-locked Loop (PLL) • High speed I/O (GPIO++) • Fast data transfer • OVERCLOCK DANGEROUS
- 14. FPGA OVERCLOCKING & WATER COOLING • 50MHz XTAL • 0-50 MHz (no cooling) • 50-200 MHz (fan/heatsink) • 200-450 MHz (water) • OVERCLOCK AT OWN RISK
- 15. BITCOIN PROOF-OF-WORK BLOCK DIAGRAM
- 16. CHIP PLANNER BLOCK UTILIZATION
- 17. FPGA PROGRAM DE0-NANO VIA FLASH LOADER
- 18. SCALABLE R&D FOR PROOF-OF-WORK ALGORITHMS • Litecoin Core example available • Pokemon your own! • Keecak SHA-3? 1/2/3 from X11?
- 19. ASIC MINERS
- 21. MADE IN CHINA, HACKED IN UK!
- 22. HEALTH HAZARDS, BE SAFE.
- 24. BEAGLECLONE – PARTIAL POPULATED BLACK PCB • L3+ / A3 / D3 model controllers • Angstorm Linux • Firmware easily dumped / downloaded • No code signing, trivial to mod • auth.minerlink.com remote manager “antbleed” • SSH / HTTP defaults ”root/root” “root/admin”
- 25. HACKING BITCOIN MINERS • Shodan / Google Dork to identify miners • Easy strings “antMiner Configuration” realm • Exposed footprint has Pre-Auth information leaks • IP geolocate large remote mining farms
- 26. BITMAIN FIRMWARE HACKING • https://github.com/cryptodashie/bitmain_hacking (reverse engineering data) • 1.5% DEV FEE (pool switching) • Blissz port cgminer-4.9 to cgminer-4.10 • Control individual boards in software, no need for hardware modifications (A++)
- 28. INTERPLANETARY FILE SYSTEM (IPFS) http://ipfs.io/ (scan data) https://github.com/cryptodashie/ipfs
- 29. HOSTS NEONAZIS, MALWARE, PORN, BLOGS...
- 30. HARDWARE WALLETS • Hardware + Firmware • Supply chain attacks • All three platforms had recent patches, props Saleem Rashid! • Chrome WebUSB (?)
- 31. WEB3.JS – ENUMERATION & PROMISE EXAMPLE Enumerate account details, interact with wallets or prompt unlocking….
- 32. RISE OF THE CRYPTONIGHT JAVASCRIPT MINER • Cryptonight proof-of-work can mine Monero (XMR) • Replace captchas, adverts or monetize links • Very low profit returns, $0.1 (users adapt)
- 34. INTERNET-OF-THINGS, PUBLIC SPACE, SHORT LINKS
- 35. MONERO-IN-THE-MIDDLE (XMR INJECTION) • Use of WiFi enabled embedded device • KARMA attack (hostapd-wpe) • PAYG Internet Connectivity via (4G) LTE • Supports multiple MITM modes of operation
- 36. DEMO
- 37. RECOMMENDED READING • Verilog by example - Blaine C. Readler • Mastering Bitcoin – Andreas Antonopoulos • Introducing Ethereum and Solidity - Chris Dannen
- 39. Q&A? THANK YOU #COINFESTUK FOR LISTENING https://hacker.house